How severe is CVE-2004-2577?

CVE-2004-2577 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2004-2577 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-2577?

CVE-2004-2577 primarily affects Phpgroupware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2004-2577?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2004-2577 published?

CVE-2004-2577 was published on 2004-12-31 and last updated on 2026-06-16.

CVE-2004-2577

CVE-2004-2577 is a medium-severity vulnerability in Phpgroupware with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Phpgroupware
Published: 2004-12-31
Last modified: 2026-06-16

Description

The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts.

Frequently asked questions

What is CVE-2004-2577?: The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts.
How severe is CVE-2004-2577?: CVE-2004-2577 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2004-2577 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2004-2577?: CVE-2004-2577 primarily affects Phpgroupware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2004-2577?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2004-2577 published?: CVE-2004-2577 was published on 2004-12-31 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:phpgroupware:phpgroupware:0.9.16rc1:*:*:*:*:*:*:*
cpe:2.3:a:phpgroupware:phpgroupware:0.9.16rc2:*:*:*:*:*:*:*

More vulnerabilities in Phpgroupware

CVE-2004-2407 — Critical (CVSS 10.0): Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security…
CVE-2004-2406 — Critical (CVSS 10.0): Unknown "overflow" in the phpgw_config table for phpGroupWare before 0.9.14.002 has unknown attack vectors and impact.
CVE-2003-0599 — Critical (CVSS 10.0): Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before…
CVE-2001-0043 — Critical (CVSS 10.0): phpGroupWare before 0.9.7 allows remote attackers to execute arbitrary PHP commands by specifying a malicious include…
CVE-2010-0404 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in phpGroupWare (phpgw) before 0.9.16.016 allow remote attackers to execute…
CVE-2009-4415 — High (CVSS 7.5): Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014,…

All CVEs affecting Phpgroupware →